mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: window.open site instance should belong to same browsing instance (#15216)

Browse source
This commit is contained in:
Pedro Pontes 2018-11-12 22:01:43 +01:00 • committed by Alexey Kuzmin
parent c06f023313
commit 8f35198bfb
10 changed files with 340 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

22
lib/browser/guest-window-manager.js
View file

@ -118,28 +118,12 @@ const createGuest = function (embedder, url, referrer, frameName, options, postD
}
guest = new BrowserWindow(options)
if (!options.webContents || url !== 'about:blank') {
if (!options.webContents) {
// We should not call `loadURL` if the window was constructed from an
// existing webContents(window.open in a sandboxed renderer) and if the url
// is not 'about:blank'.
// existing webContents (window.open in a sandboxed renderer).
//
// Navigating to the url when creating the window from an existing
// webContents would not be necessary(it will navigate there anyway), but
// apparently there's a bug that allows the child window to be scripted by
// the opener, even when the child window is from another origin.
//
// That's why the second condition(url !== "about:blank") is required: to
// force `OverrideSiteInstanceForNavigation` to be called and consequently
// spawn a new renderer if the new window is targeting a different origin.
//
// If the URL is "about:blank", then it is very likely that the opener just
// wants to synchronously script the popup, for example:
//
// let popup = window.open()
// popup.document.body.write('<h1>hello</h1>')
//
// The above code would not work if a navigation to "about:blank" is done
// here, since the window would be cleared of all changes in the next tick.
// webContents is not necessary (it will navigate there anyway).
const loadOptions = {
httpReferrer: referrer
}